linux-stable.git/net/ipv4/devinet.c, branch linux-3.8.y

ipv4: fix NULL checking in devinet_ioctl()

2013-01-07T05:11:18+00:00

The NULL pointer check `!ifa' should come before its first use.

[ Bug origin : commit fd23c3b31107e2fc483301ee923d8a1db14e53f4
  (ipv4: Add hash table of interface addresses) in linux-2.6.39 ]

Signed-off-by: Xi Wang 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

netconf: advertise mc_forwarding status

2012-12-04T18:08:10+00:00

This patch advertise the MC_FORWARDING status for IPv4 and IPv6.
This field is readonly, only multicast engine in the kernel updates it.

Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller

net: Enable a userns root rtnl calls that are safe for unprivilged users

2012-11-19T01:33:36+00:00

- Only allow moving network devices to network namespaces you have
  CAP_NET_ADMIN privileges over.

- Enable creating/deleting/modifying interfaces
- Enable adding/deleting addresses
- Enable adding/setting/deleting neighbour entries
- Enable adding/removing routes
- Enable adding/removing fib rules
- Enable setting the forwarding state
- Enable adding/removing ipv6 address labels
- Enable setting bridge parameter

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

net: Enable some sysctls that are safe for the userns root

2012-11-19T01:33:00+00:00

- Enable the per device ipv4 sysctls:
   net/ipv4/conf//forwarding
   net/ipv4/conf//mc_forwarding
   net/ipv4/conf//accept_redirects
   net/ipv4/conf//secure_redirects
   net/ipv4/conf//shared_media
   net/ipv4/conf//rp_filter
   net/ipv4/conf//send_redirects
   net/ipv4/conf//accept_source_route
   net/ipv4/conf//accept_local
   net/ipv4/conf//src_valid_mark
   net/ipv4/conf//proxy_arp
   net/ipv4/conf//medium_id
   net/ipv4/conf//bootp_relay
   net/ipv4/conf//log_martians
   net/ipv4/conf//tag
   net/ipv4/conf//arp_filter
   net/ipv4/conf//arp_announce
   net/ipv4/conf//arp_ignore
   net/ipv4/conf//arp_accept
   net/ipv4/conf//arp_notify
   net/ipv4/conf//proxy_arp_pvlan
   net/ipv4/conf//disable_xfrm
   net/ipv4/conf//disable_policy
   net/ipv4/conf//force_igmp_version
   net/ipv4/conf//promote_secondaries
   net/ipv4/conf//route_localnet

- Enable the global ipv4 sysctl:
   net/ipv4/ip_forward

- Enable the per device ipv6 sysctls:
   net/ipv6/conf//forwarding
   net/ipv6/conf//hop_limit
   net/ipv6/conf//mtu
   net/ipv6/conf//accept_ra
   net/ipv6/conf//accept_redirects
   net/ipv6/conf//autoconf
   net/ipv6/conf//dad_transmits
   net/ipv6/conf//router_solicitations
   net/ipv6/conf//router_solicitation_interval
   net/ipv6/conf//router_solicitation_delay
   net/ipv6/conf//force_mld_version
   net/ipv6/conf//use_tempaddr
   net/ipv6/conf//temp_valid_lft
   net/ipv6/conf//temp_prefered_lft
   net/ipv6/conf//regen_max_retry
   net/ipv6/conf//max_desync_factor
   net/ipv6/conf//max_addresses
   net/ipv6/conf//accept_ra_defrtr
   net/ipv6/conf//accept_ra_pinfo
   net/ipv6/conf//accept_ra_rtr_pref
   net/ipv6/conf//router_probe_interval
   net/ipv6/conf//accept_ra_rt_info_max_plen
   net/ipv6/conf//proxy_ndp
   net/ipv6/conf//accept_source_route
   net/ipv6/conf//optimistic_dad
   net/ipv6/conf//mc_forwarding
   net/ipv6/conf//disable_ipv6
   net/ipv6/conf//accept_dad
   net/ipv6/conf//force_tllao

- Enable the global ipv6 sysctls:
   net/ipv6/bindv6only
   net/ipv6/icmp/ratelimit

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

net: Allow userns root to control ipv4

2012-11-19T01:32:45+00:00

Allow an unpriviled user who has created a user namespace, and then
created a network namespace to effectively use the new network
namespace, by reducing capable(CAP_NET_ADMIN) and
capable(CAP_NET_RAW) calls to be ns_capable(net->user_ns,
CAP_NET_ADMIN), or capable(net->user_ns, CAP_NET_RAW) calls.

Settings that merely control a single network device are allowed.
Either the network device is a logical network device where
restrictions make no difference or the network device is hardware NIC
that has been explicity moved from the initial network namespace.

In general policy and network stack state changes are allowed
while resource control is left unchanged.

Allow creating raw sockets.
Allow the SIOCSARP ioctl to control the arp cache.
Allow the SIOCSIFFLAG ioctl to allow setting network device flags.
Allow the SIOCSIFADDR ioctl to allow setting a netdevice ipv4 address.
Allow the SIOCSIFBRDADDR ioctl to allow setting a netdevice ipv4 broadcast address.
Allow the SIOCSIFDSTADDR ioctl to allow setting a netdevice ipv4 destination address.
Allow the SIOCSIFNETMASK ioctl to allow setting a netdevice ipv4 netmask.
Allow the SIOCADDRT and SIOCDELRT ioctls to allow adding and deleting ipv4 routes.

Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL and SIOCDELTUNNEL ioctls for
adding, changing and deleting gre tunnels.

Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL and SIOCDELTUNNEL ioctls for
adding, changing and deleting ipip tunnels.

Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL and SIOCDELTUNNEL ioctls for
adding, changing and deleting ipsec virtual tunnel interfaces.

Allow setting the MRT_INIT, MRT_DONE, MRT_ADD_VIF, MRT_DEL_VIF, MRT_ADD_MFC,
MRT_DEL_MFC, MRT_ASSERT, MRT_PIM, MRT_TABLE socket options on multicast routing
sockets.

Allow setting and receiving IPOPT_CIPSO, IP_OPT_SEC, IP_OPT_SID and
arbitrary ip options.

Allow setting IP_SEC_POLICY/IP_XFRM_POLICY ipv4 socket option.
Allow setting the IP_TRANSPARENT ipv4 socket option.
Allow setting the TCP_REPAIR socket option.
Allow setting the TCP_CONGESTION socket option.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

net: Push capable(CAP_NET_ADMIN) into the rtnl methods

2012-11-19T01:32:44+00:00

- In rtnetlink_rcv_msg convert the capable(CAP_NET_ADMIN) check
  to ns_capable(net->user-ns, CAP_NET_ADMIN).  Allowing unprivileged
  users to make netlink calls to modify their local network
  namespace.

- In the rtnetlink doit methods add capable(CAP_NET_ADMIN) so
  that calls that are not safe for unprivileged users are still
  protected.

Later patches will remove the extra capable calls from methods
that are safe for unprivilged users.

Acked-by: Serge Hallyn 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

net: Don't export sysctls to unprivileged users

2012-11-19T01:30:55+00:00

In preparation for supporting the creation of network namespaces
by unprivileged users, modify all of the per net sysctl exports
and refuse to allow them to unprivileged users.

This makes it safe for unprivileged users in general to access
per net sysctls, and allows sysctls to be exported to unprivileged
users on an individual basis as they are deemed safe.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

rtnl/ipv4: use netconf msg to advertise rp_filter status

2012-11-01T16:41:34+00:00

Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller

rtnl/ipv4: add support of RTM_GETNETCONF

2012-10-28T23:05:00+00:00

This message allows to get the devconf for an interface.

Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller

rtnl/ipv4: use netconf msg to advertise forwarding status

2012-10-28T23:05:00+00:00

Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller